All checks
Medium
CloudFront distributions should have logging enabled
Verifies that server access logging is enabled for CloudFront distributions.
- service
- CloudFront
- severity
- Medium
- scope
- evaluated once per account
How to fix it
Turn standard logging (legacy) on for the distribution and name an S3 bucket for it. The bucket has three requirements, and delivery fails quietly without them: ACLs enabled rather than Object Ownership bucket owner enforced, a Region that is enabled by default, and, where it is encrypted with SSE-KMS, a customer managed key whose policy lets delivery.logs.amazonaws.com generate a data key. Standard logging (v2) and real-time logs do not clear this control; the legacy variant has to be on alongside them.
In the console
CloudFront → Distributions → the distribution → Logging → Standard logging, delivered to Amazon S3 (Legacy)
See which of your accounts this check is failing on.
Book a demo